MALICIOUS — fc2735dfe65eb162a0065c013c0d53165bda7244a6efb5261022d7be7c76c677

MALICIOUS — fc2735dfe65eb162a0065c013c0d53165bda7244a6efb5261022d7be7c76c677 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: fc2735dfe65eb162a0065c013c0d53165bda7244a6efb5261022d7be7c76c677
SHA-1: d86c4d5362693d5ace2cde79e56419cfaccf1467
MD5: f71ce6ddb9108dd8006b42a97ff0d135
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SF8vFchxPv/GUdK0v9vmWBm1tXBcyGc:O+K88uPCHaUmUpv9voXeyGc
TLSH: T1655A23869A1A5B08E3F6D5803C0936AEC541E4E6927C48C982CFF12D73DB877747219B
Submitted as: fc2735dfe65eb162a0065c013c0d53165bda7244a6efb5261022d7be7c76c677
File type: pe · Size: 2089472 bytes
Verdict: malicious (98/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

102 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\5C73.tmp - a975af946ade9f2f7bd77c1a456c57fe1e0bc96edf9a8b3dd32707f3fb4b33c6
975585eea0756835b2106620d7a4118390045b988d8b3f4d5b84a1fa327f7596 - 975585eea0756835b2106620d7a4118390045b988d8b3f4d5b84a1fa327f7596

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787932300&P2=404&P3=2&P4=ZIneDMnxZAcNLV%2bb24qjoGBOfiI4MPWM2dzX3DFigJSTWqgcxh76r%2fwjcxaA937axPr6yVc86UpR%2bl2DZx0m4g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787932328&P2=404&P3=2&P4=ZZFsvuTGmVK0YxYNhASE9jyYFT5B0cRchxSwYKNtkIEfwcIQBDWrVo%2fgatMm59TRlW2V%2figpSsqNEoD5VEiMZg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

85.210.196.11
4.150.223.112
4.247.188.233
4.230.171.124
4.144.132.223
74.179.77.204
20.165.94.54
4.150.223.106
20.112.250.133
52.123.129.14
172.66.2.5
4.150.223.109
135.234.160.246
52.123.252.220
74.179.71.159
203.26.79.13
52.148.114.188
20.42.179.192
92.223.78.30
72.145.35.99
52.178.17.3
4.207.44.73
135.233.95.80
52.110.12.32
52.110.12.1

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report